forked from denoland/fresh
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add page about setting raw HTML content (denoland#2189)
- Loading branch information
1 parent
d19c22d
commit 48124dc
Showing
2 changed files
with
83 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,81 @@ | ||
--- | ||
description: | | ||
How to render raw HTML in Fresh. | ||
--- | ||
|
||
Text content in Fresh is always escaped, whether serverside rendered or rendered | ||
in islands. While this generally desired, it can create issues in certain | ||
situations. | ||
|
||
## Warning | ||
|
||
The TL;DR is to use Preact's `dangerouslySetInnerHTML`. As the name implies, | ||
it should not be used lightly. | ||
|
||
Setting arbitrary HTML can be dangerous. Make sure you trust the source. | ||
Rendering user-supplied HTML to the DOM makes your site vulnerable to cross- | ||
site scripting. The markup must first be sanitizied, or better | ||
yet, something you trust. | ||
|
||
## Example: Rendering JSON-LD | ||
|
||
Suppose we need to add some microdata markup to a page. The following will | ||
result in **escaped charaters, and will not work**: | ||
|
||
```tsx | ||
const json = ` | ||
{ | ||
"@context": "http://schema.org", | ||
"@type": "PostalAddress", | ||
"streetAddress": "8888 University Drive", | ||
"addressLocality": "Burnaby", | ||
"addressRegion": "British Columbia" | ||
`; | ||
|
||
export default function JsonLd() { | ||
return ( | ||
<script type="application/ld+json">{json}</script> | ||
); | ||
} | ||
``` | ||
|
||
Instead, we can use `dangerouslySetInnerHTML`: | ||
|
||
```tsx | ||
export default function JsonLd() { | ||
return ( | ||
<script type="application/ld+json" | ||
dangerouslySetInnerHTML={{ __html: json }} | ||
/> | ||
); | ||
} | ||
``` | ||
|
||
## Another example: Code highlighting | ||
|
||
Syntax highlighers parse strings into HTML tags, allowing them to be | ||
individually styled with CSS. We can build a simple Preact syntax highligher | ||
like so: | ||
|
||
```tsx | ||
import Prism from "https://esm.sh/prismjs@1.29.0"; | ||
|
||
interface Props { | ||
code: string; | ||
lang: string; | ||
} | ||
|
||
export default function Code({ code, lang }: Props) { | ||
const parsed = Prism.highlight(code, Prism.languages[lang], lang); | ||
|
||
return ( | ||
<pre data-lang={lang} className={`language-${lang}`}> | ||
<code dangerouslySetInnerHTML={{ | ||
__html: parsed | ||
}} /> | ||
</pre> | ||
); | ||
} | ||
``` | ||
|
||
Of course, we will also have to add some CSS to make this look nice. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters